connector update: support snowflake + databricks dialects

[bradfair]

Context

ana connector create now supports Snowflake (#17) and Databricks (#21), but ana connector update is still postgres-only. From internal/connector/update.go:

if cli.FlagWasSet(fs, "type") && *typ != "postgres" {
    return cli.UsageErrf(\"connector update: --type must be \\\"postgres\\\" (got %q)\", *typ)
}

The merge path overlays PostgresMetadata only — no SnowflakeMetadata / DatabricksMetadata handling, no auth-mode branching. Scripted credential rotation, host/warehouse flips, and config tweaks against Snowflake/Databricks connectors are still blocked on the UI or raw RPC.

Originally flagged in #1's scope notes; deferred out of the create work and split here for focused scope.

Why it hurts

• Credential rotation — the common "create new secret → flip references → delete old" pattern requires update to accept Snowflake passwords/keypairs/OAuth client secrets and Databricks PATs/M2M client secrets.
• Config drift repair — warehouse / role / HTTP-path / catalog / schema changes can't be applied via CLI; operators have to drop + recreate, losing the connector id.
• Parity expectation — any scripted flow that uses create <dialect> today naturally reaches for update next and hits the wall.

Proposed scope

Mirror the subcommand tree that create uses — ana connector update <dialect> <mode> <id> (or a flatter shape if that reads better during design). Same auth modes:

Snowflake: password / keypair / oauth-sso / oauth-individual
Databricks: access-token / client-credentials / oauth-sso / oauth-individual

Keep the current "pre-fetch baseline + overlay only touched fields" pattern so a rename or single-field tweak doesn't force re-entry of the full spec. GetConnector already returns the persisted spec sans secrets, so overlay is safe.

Scope notes

• Secret handling: reuse resolveSecret / resolveOptionalPassphrase and the --*-stdin pattern from create. No plaintext secrets on argv.
• Auth-mode switching: updating from e.g. Snowflake password → keypair should be explicit (re-select mode at invocation), not inferred from flag presence.
• Test parity: match the create unit-test template (happy path, stdin variants, per-field omit-empty assertions, JSON bypass, render error, unary error). Extend e2e to cover an update smoke per dialect.
• connector test <id>: already dialect-agnostic; no change needed.

Out of scope

• Adding new fields beyond what create already exposes.
• Migrating the existing postgres update shape (keep it working).